General Terms

This English version is provided for informational purposes only. The Swedish version is the legally binding document.

This document consists of two parts: Part 1 — General Terms, and Part 2 — Appendix 1: Data Processing Agreement (DPA).

Part 1 — General Terms

These General Terms ("the Terms") govern the provision and use of the cloud-based service FinPeak. The Terms constitute an agreement between FinPeak AB and the company accepting the Terms. By accepting the Terms – either via approval on FinPeak's website or by written confirmation by email – the parties enter into a binding agreement on the terms set out below.

1. Definitions

1.1 FinPeak means FinPeak AB, company reg. no. 559529-9529, with address Björksundsslingan 34D, 124 31 Bandhagen, Sweden. The Customer means the company (business entity) stated upon acceptance of the Terms and on whose behalf the Service is used. The Parties means FinPeak and the Customer collectively.

1.2 The Service means FinPeak's cloud-based analysis and reporting platform, available via portal.finpeak.se, in the form in which it is provided from time to time. Customer Data means the information, files and materials that the Customer or its users upload to the Service.

1.3 Users means the natural persons to whom the Customer grants access to the Service.

2. The Service and its Scope

2.1 The Service is a cloud-based platform for analysis, modelling and reporting of financial information that the Customer uploads to the Service.

2.2 The Service's current features and scope are described in the Service and on finpeak.se. The Service is provided as a standardised cloud service. FinPeak continuously develops, modifies and improves the Service and is entitled to add, change or remove features, provided that the main functionality of the Service is not materially impaired during an ongoing subscription period.

2.3 The Service is a tool for analysis and reporting. The Service does not constitute advisory services and does not replace the Customer's bookkeeping, accounting, audit or statutory obligation to prepare financial reports. The Customer is responsible for the accuracy of its own conclusions and decisions.

2.4 FinPeak is entitled to engage subcontractors, for example for operations, storage and hosting of the Service, in order to fulfil its obligations under the agreement. FinPeak is responsible for the work of any engaged subcontractor as for its own.

3. Conclusion of the Agreement and Authority

3.1 The agreement is concluded when the Customer accepts the Terms, either by active approval on FinPeak's website or by written confirmation by email.

3.2 The Terms are directed exclusively at business entities. The Service is not offered to consumers, and consumer protection legislation does not apply to the agreement.

3.3 The person accepting the Terms thereby confirms that he or she is authorised to enter into the agreement on behalf of the Customer and to bind the Customer to the Terms. FinPeak is entitled to assume this is the case and has no obligation to verify the person's authority.

3.4 Upon acceptance, the Customer shall provide accurate company name, company registration number, and the name, position and email address of the person accepting. The Customer is responsible for ensuring that this information is accurate and kept up to date.

4. Fees and Payment Terms

4.1 The fee for the Service is SEK 1,000 per month, excluding VAT.

4.2 The Service begins with a free trial period of fourteen (14) days from the date the agreement was concluded. If the Customer does not terminate the Service before the end of the trial period, the Service automatically transitions into an ongoing paid subscription in accordance with section 4.1.

4.3 The fee is invoiced monthly in advance. Payment shall be made within thirty (30) days from the invoice date. In the event of late payment, default interest shall accrue in accordance with the Swedish Interest Act, as well as statutory reminder and collection fees where applicable.

4.4 FinPeak is entitled to change the fee. Fee changes shall be communicated to the Customer at least thirty (30) days in advance. If the Customer does not accept the changed fee, the Customer has the right to terminate the Service so that it ceases before the change takes effect.

4.5 In the event of non-payment despite a reminder, FinPeak is entitled to suspend the Customer's access to the Service until full payment has been made.

5. Term and Termination

5.1 The agreement runs until further notice with no fixed commitment period.

5.2 Either party has the right to terminate the agreement at any time. Termination takes effect at the end of the current paid monthly period. Paid fees are not refunded for the ongoing period.

5.3 FinPeak has the right to terminate or suspend the Service with immediate effect if the Customer materially breaches the Terms, if the Customer fails to pay despite a reminder, or if the Customer becomes insolvent or can otherwise be presumed to be insolvent.

5.4 Upon termination of the agreement, the Customer's access to the Service ceases. The Customer is responsible for exporting its Customer Data in good time before termination. FinPeak is entitled to delete Customer Data after termination in accordance with section 9.

6. Customer's Obligations and Responsibilities

6.1 The Customer is responsible for all use of the Service that takes place through the Customer's accounts and Users, and for ensuring that login credentials are handled securely and not made available to unauthorised persons.

6.2 The Customer is responsible for the Customer Data, including ensuring that the Customer has the right to process and upload it, that it is accurate and complete, and that it is free from malicious code.

6.3 The Customer may not use the Service in violation of law, to circumvent the Service's technical restrictions, or in a manner that risks harming or disrupting the Service or other customers' use.

6.4 The Customer may not copy, decompile, resell, lease, or otherwise make the Service available to third parties beyond what is expressly permitted under the Terms.

7. Availability, Support and Defects

7.1 The Service is provided on an "as is" basis. FinPeak strives for high and uninterrupted availability but does not provide any guarantee of a specific service level (SLA).

7.2 FinPeak is entitled to carry out planned maintenance and updates, which may temporarily limit access to the Service. Planned maintenance likely to cause more than negligible impact shall, where possible, be announced in advance and scheduled at times when usage is normally low.

7.3 FinPeak provides support via email. FinPeak responds to support requests as soon as possible, normally within three (3) business days. The stated response time is a guideline and does not constitute a guaranteed service level.

7.4 A defect means that the Service does not function in accordance with the Terms and that this is attributable to FinPeak. The Customer shall report defects to FinPeak without unreasonable delay after the defect was discovered or should have been discovered. FinPeak shall then remedy the defect within a reasonable time given the nature of the defect and other circumstances. FinPeak is not responsible for defects caused by the Customer, the Customer Data, Users, the Customer's equipment or software, or by disruptions in the internet or other communications outside FinPeak's control.

8. Intellectual Property Rights

8.1 All intellectual property rights to the Service, including software, structure, design, trademarks and documentation, belong to FinPeak or FinPeak's licensors. The agreement does not transfer any such rights to the Customer.

8.2 During the term of the agreement, the Customer is granted a non-exclusive, non-transferable right to use the Service for its own internal operations in accordance with the Terms.

9. Customer Data, Confidentiality and Personal Data

9.1 The Customer retains ownership of and all rights to the Customer Data. FinPeak acquires no rights to the Customer Data beyond what is necessary to provide the Service in accordance with the Terms.

9.2 FinPeak processes Customer Data solely for the purpose of providing and maintaining the Service and in accordance with the Customer's instructions. FinPeak is entitled to process anonymised and aggregated information about the use of the Service for the purpose of operating and improving the Service.

9.3 The Customer may at any time during the term of the agreement export its Customer Data from the Service.

9.4 To the extent that FinPeak processes personal data on behalf of the Customer when providing the Service, such processing is governed by a separate data processing agreement (Appendix 1), which constitutes an integrated part of the agreement.

9.5 Each party shall maintain confidentiality regarding the other party's confidential information and shall not disclose such information to third parties without the other party's consent, except to the extent required by law or governmental decision.

9.6 After termination of the agreement, FinPeak is entitled to delete Customer Data. Deletion takes place no earlier than thirty (30) days after termination of the agreement, after which Customer Data can no longer be restored.

10. Liability and Limitation of Liability

10.1 FinPeak is not responsible for the accuracy of Customer Data or for the structures, models, reports or conclusions that the Customer creates using the Service. The Customer is responsible for verifying underlying data and results before using them as a basis for decisions or external reporting.

10.2 FinPeak is in no event liable for indirect damages or consequential damages, such as loss of profit, loss of data, lost savings, production losses, or third-party claims.

10.3 FinPeak's aggregate liability for damages under the agreement is, for each twelve-month period, limited to an amount equal to the fees paid by the Customer for the Service during the twelve (12) months immediately preceding the event giving rise to the liability.

10.4 The limitations of liability in this section 10 do not apply in cases of intent or gross negligence, nor to the extent they conflict with mandatory law.

10.5 Claims against FinPeak shall be submitted in writing without unreasonable delay and no later than three (3) months from the date on which the circumstance on which the claim is based was discovered or should have been discovered.

11. Force Majeure

11.1 A party is released from liability for failure to perform an obligation if the failure is due to a circumstance beyond the party's control which the party could not reasonably have foreseen or avoided, such as governmental action, general disruption of electricity or telecommunications, war, natural disaster, or interruption at a subcontractor on whom the party is dependent.

12. Changes to the Terms

12.1 FinPeak is entitled to change the Terms. Material changes shall be communicated to the Customer at least thirty (30) days before they take effect, via email or in the Service.

12.2 If the Customer does not accept a material change, the Customer has the right to terminate the agreement so that it ceases before the change takes effect. If the Customer continues to use the Service after the change has taken effect, the Customer is deemed to have accepted the amended Terms.

12.3 Each version of the Terms is given a version designation. The version accepted by the Customer applies until a new version has taken effect in accordance with this section.

13. Assignment

13.1 The Customer may not assign its rights or obligations under the agreement without FinPeak's written consent. FinPeak is entitled to assign the agreement to another company within the same group or in connection with a transfer of the business of which the Service forms part.

14. Governing Law and Dispute Resolution

14.1 Swedish law shall apply to the agreement, excluding its conflict of law rules.

14.2 Disputes arising from the agreement shall in the first instance be resolved through negotiation between the Parties. If the Parties fail to reach agreement, the dispute shall be decided by ordinary court, with Stockholm District Court as the court of first instance.

15. Documents of the Agreement and Order of Interpretation

15.1 The agreement consists of these Terms and the associated data processing agreement (Appendix 1). In the event of conflict between the documents, these Terms shall prevail, unless otherwise expressly stated in the data processing agreement.

Part 2 — Appendix 1: Data Processing Agreement

This data processing agreement ("DPA") governs FinPeak's processing of personal data on behalf of the Customer when providing the Service. The DPA constitutes Appendix 1 to and an integrated part of FinPeak's General Terms ("the Terms"). Terms defined in the General Terms have the same meaning here.

1. Background and Roles

1.1 When FinPeak provides the Service, FinPeak may process personal data on behalf of the Customer. The Customer is the data controller for such personal data. FinPeak is the data processor.

1.2 This DPA governs FinPeak's processing of personal data on behalf of the Customer and applies for as long as FinPeak processes such personal data.

1.3 The subject matter of the processing, its duration, nature and purpose, the types of personal data processed and the categories of data subjects are set out in Sub-appendix A.

2. FinPeak's Processing of Personal Data

2.1 FinPeak processes personal data only in accordance with the Customer's documented instructions. The Terms, this DPA with sub-appendices and the use of the Service these documents enable constitute the Customer's complete instructions at the time of entering into this DPA.

2.2 If FinPeak lacks instructions for a particular processing activity, or considers that an instruction conflicts with applicable data protection legislation, FinPeak shall inform the Customer without unreasonable delay.

2.3 FinPeak does not process personal data for its own purposes and does not disclose personal data to third parties, except as provided in this DPA or as required by law. If FinPeak is required by law to disclose personal data, FinPeak shall, where permitted, inform the Customer in advance.

3. Security

3.1 FinPeak shall take appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against loss, destruction or damage. The measures shall correspond to the risk posed by the processing.

3.2 FinPeak shall ensure that the persons who process personal data at FinPeak have undertaken to maintain confidentiality or are subject to an appropriate statutory duty of confidentiality.

4. Sub-processors

4.1 The Customer grants FinPeak a general prior approval to engage sub-processors for the processing. The sub-processors engaged at the time of entering into this DPA are listed in Sub-appendix B.

4.2 FinPeak shall, through a written agreement, impose on each sub-processor data protection obligations that are substantially equivalent to those that apply to FinPeak under this DPA. FinPeak is responsible vis-à-vis the Customer for the sub-processor's processing as for its own.

4.3 FinPeak shall inform the Customer in advance of any planned additions to or changes of sub-processors, allowing the Customer reasonable time to object. The Customer may, within a reasonable time, raise substantiated objections to a new sub-processor. If the Parties cannot reach agreement, the Customer has the right to terminate the Service in accordance with the Terms.

5. Transfers to Third Countries

5.1 FinPeak's own processing of personal data takes place within the EU/EEA. Primary storage and processing takes place in Sweden.

5.2 To the extent that a sub-processor processes personal data in a country outside the EU/EEA, such transfer shall be made under a valid transfer mechanism pursuant to Chapter V of the GDPR, such as the European Commission's standard contractual clauses.

6. Assistance to the Customer

6.1 FinPeak shall, taking into account the nature of the processing and the information available to FinPeak, to a reasonable extent assist the Customer with appropriate technical and organisational measures to enable the Customer to fulfil its obligation to respond to a data subject's request to exercise their rights under the GDPR.

6.2 FinPeak shall correspondingly assist the Customer in fulfilling the obligations regarding security, notification of personal data breaches, impact assessments and prior consultation under Articles 32–36 of the GDPR.

6.3 FinPeak is entitled to reasonable compensation for assistance under this section 6 to the extent that the assistance goes beyond what is reasonably included in the Service.

7. Personal Data Breaches

7.1 FinPeak shall, without unreasonable delay after becoming aware of a personal data breach affecting the personal data being processed, inform the Customer.

7.2 The information shall include the details reasonably required for the Customer to fulfil its own notification obligation, to the extent such information is available to FinPeak.

8. Audit

8.1 FinPeak shall, at the Customer's request, make available the information required to demonstrate compliance with the obligations under this DPA.

8.2 The Customer has the right to audit FinPeak's compliance with this DPA. Such audit shall be announced with reasonable notice in advance, conducted during normal business hours and carried out in a manner that does not unnecessarily disrupt FinPeak's operations. FinPeak may fulfil its obligation by providing relevant documentation or reports.

9. Deletion upon Termination

9.1 When the processing ceases, FinPeak shall, at the Customer's choice, delete or return the personal data, and delete existing copies, unless continued storage is required by law. Deletion shall take place within the time specified in the Terms.

10. Liability and Miscellaneous

10.1 The Parties' liability for the processing of personal data is governed by data protection legislation. In the relationship between the Parties, the limitation of liability set out in the Terms applies also to this DPA, to the extent not prohibited by mandatory law.

10.2 This DPA applies for as long as FinPeak processes personal data on behalf of the Customer. In the event of conflict between this DPA and the Terms, this DPA shall prevail on matters relating to the processing of personal data.

10.3 This DPA is governed by Swedish law. Disputes shall be resolved in accordance with the Terms.

Sub-appendix A — Specification of the Processing

Subject matter of the processing:

FinPeak's processing of personal data on behalf of the Customer when providing the Service in accordance with the Terms.

Duration:

For as long as FinPeak provides the Service to the Customer and processes personal data on behalf of the Customer.

Nature and purpose of the processing:

Collection, storage, structuring, access and other processing required to provide, operate, maintain and support the Service, including administering the Customer's accounts and Users.

Categories of data subjects:

• The Customer's contact persons and Users
• Natural persons whose personal data may appear in the financial information that the Customer uploads to the Service

Categories of personal data:

• Identity and contact details for contact persons and Users (name, position, email address)
• Login and account information
• Personal data that may appear in financial information uploaded by the Customer, such as names in account descriptions

Special categories of personal data:

Not processed intentionally. The Customer shall not upload sensitive personal data as defined in Article 9 of the GDPR to the Service.

Sub-appendix B — List of Sub-processors

Microsoft Ireland Operations Limited

Service: Cloud infrastructure and hosting (Microsoft Azure). Location of processing: EU/EEA – Sweden (Azure Sweden Central).

Microsoft Ireland Operations Limited

Service: Email (Microsoft 365 / Outlook) for communication with the Customer's contact persons and Users. Location of processing: EU/EEA.

Visma Spiris AB

Service: Invoicing and bookkeeping system. Location of processing: EU/EEA – Sweden.

This list reflects the sub-processors engaged at the time this version enters into force and may be updated in accordance with section 4 of the DPA.